I’m starting to think this is going to be a thing that needs an upstream fix in Coursier, to handle that bogus POM from maven.org…